linux-kernel - [PATCH] Input: i8042 - i8042_flush fix for a full 8042 buffer

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:	Sat,  7 Sep 2013 11:45:08 +0400
From:	Andrey Moiseev <o2g.org.ru@...il.com>
To:	dmitry.torokhov@...il.com
Cc:	linux-input@...r.kernel.org, linux-kernel@...r.kernel.org,
	Andrey Moiseev <o2g.org.ru@...il.com>
Subject: [PATCH] Input: i8042 - i8042_flush fix for a full 8042 buffer

When 8042 internal data buffer is full, the driver
erroneously decides that the controller is not present.

i8042_flush returns the number of flushed bytes, which is
in 0 - I8042_BUFFER_SIZE range inclusive. Therefore, i8042_flush
has no way to indicate an error. Moreover i8042_controller_check
takes initially full buffer (i8042_flush returned
I8042_BUFFER_SIZE) as a sign of absence of the controller.

The fix:
i8042_flush should perform one more status check after
I8042_BUFFER_SIZE bytes have been read, and, if it succeeds,
indicate the error by returning -1. i8042_controller_check
should be changed appropriately.

Signed-off-by: Andrey Moiseev <o2g.org.ru@...il.com>
---
diff --git a/drivers/input/serio/i8042.c b/drivers/input/serio/i8042.c
index 78e4de4..cdda786 100644
--- a/drivers/input/serio/i8042.c
+++ b/drivers/input/serio/i8042.c
@@ -222,29 +222,32 @@ static int i8042_wait_write(void)
 static int i8042_flush(void)
 {
 	unsigned long flags;
 	unsigned char data, str;
 	int i = 0;

 	spin_lock_irqsave(&i8042_lock, flags);

-	while (((str = i8042_read_status()) & I8042_STR_OBF) && (i < I8042_BUFFER_SIZE)) {
+	while (((str = i8042_read_status()) & I8042_STR_OBF) && (i <= I8042_BUFFER_SIZE)) {
 		udelay(50);
 		data = i8042_read_data();
 		i++;
 		dbg("%02x <- i8042 (flush, %s)\n",
 		    data, str & I8042_STR_AUXDATA ? "aux" : "kbd");
 	}

 	spin_unlock_irqrestore(&i8042_lock, flags);

+	if (i == I8042_BUFFER_SIZE + 1)
+		return -1;
+
 	return i;
 }

 /*
  * i8042_command() executes a command on the i8042. It also sends the input
  * parameter(s) of the commands to it, and receives the output value(s). The
  * parameters are to be stored in the param array, and the output is placed
  * into the same array. The number of the parameters and output values is
  * encoded in bits 8-11 of the command number.
  */

@@ -849,11 +852,11 @@ static int __init i8042_check_aux(void)

 static int i8042_controller_check(void)
 {
-	if (i8042_flush() == I8042_BUFFER_SIZE) {
+	if (i8042_flush() == -1) {
 		pr_err("No controller found\n");
 		return -ENODEV;
 	}

 	return 0;
 }

-- 
1.8.4

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/